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The  Department  of  Defense  (DOD)  relies  on  a  global  network  of  defense  critical 
infrastructure  so  essential  that  the  incapacitation,  exploitation,  or  destruction  of  an 
asset  within  this  network  could  severely  affect  DOD’s  ability  to  deploy,  support,  and 
sustain  its  forces  and  operations  worldwide  and  to  implement  its  core  missions, 
including  current  missions  in  Iraq  and  Afghanistan.  Because  of  its  importance  to  DOD 
operations,  this  defense  critical  infrastructure  could  be  vulnerable  to  attacks  by 
adversaries,  and  vulnerable  to  natural  disasters  and  hazards,  such  as  hurricanes  and 
earthquakes.  Since  September  2003,  the  Office  of  the  Assistant  Secretary  of  Defense 
for  Homeland  Defense  and  Americas’  Security  Affairs  (ASD[HD&ASA])  has  been 
responsible  for  developing  and  ensuring  implementation  of  critical  infrastructure 
protection  policy  and  program  guidance.  To  identify  and  help  assure  the  availability 
of  this  mission-critical  infrastructure,  in  August  2005  DOD  established  the  Defense 
Critical  Infrastructure  Program  (DCIP),1  assigning  overall  responsibility  for  the 
program  to  ASD(HD&ASA).“  In  April  2008,  DOD  issued  an  instruction  that  further 
assigned  responsibilities  and  prescribed  procedures  for  the  implementation  of  DCIP, 
among  other  things.3  In  October  2008,  DOD  formalized  the  process  for  identifying 
and  prioritizing  its  critical  infrastructure.4 

Since  2006,  ASD(HD&ASA)  has  collaborated  with  the  Joint  Staff  to  compile  a  list  of 
all  DOD-  and  non-DOD-owned  infrastructure  essential  to  accomplish  DOD’s  missions. 
To  support  this  effort,  the  combatant  commands  and  military  services  are  to  identify 
and  place  their  critical  assets  into  prioritized  tiers,0  including  Tier  1  Task  Critical 


1  DOD  Directive  3020.40,  Defense  Critical  Infrastructure  Program  (DCIP),  (Aug.  19,  2005). 

2  Earlier  programs  analogous  to  DCIP  can  be  traced  back  to  1998. 

3  DOD  Instruction  3020.45,  Defense  Critical  Infrastructure  Program  (DCIP)  Management  (Apr.  21, 
2008). 

4  DOD  Manual  3020. 45-M,  Defense  Critical  Infrastructure  Program  (DCIP):  DOD  Mission-Based 
Critical  Asset  Identification  Process  (CAIP),  Volume  1  (Oct.  24,  2008). 

5  According  to  DOD’s  critical  asset  identification  guidance,  the  definitions  of  the  tiered  Task  Critical 
Assets  are:  Tier  1 — An  asset  the  loss,  incapacitation,  or  disruption  of  which  could  result  in  mission  (or 
function)  failure  at  the  DOD,  military  department,  combatant  command,  sub-unified  command, 
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Assets,  which  are  assets  of  such  extraordinary  importance  that  their  incapacitation  or 
destruction  would  have  a  serious,  debilitating  effect  on  the  ability  of  one  or  more 
military  services,  combatant  commands,  or  DCIP  Defense  Infrastructure  Sector  Lead 
Agents  to  execute  the  mission  essential  tasks  they  support.  Defense  Critical  Assets,6 7 
on  the  other  hand,  are  the  assets  most  critical  for  fulfilling  overall  DOD  missions  and 
are  identified  from  the  universe  of  Task  Critical  Assets.  The  Joint  Staff  worked  with 
the  combatant  commands,  military  services,  and  Defense  Infrastructure  Sector  Lead 
Agents  to  develop  the  current  departmentwide  list  of  Tier  1  Task  Critical  Assets.  In 
October  2008,  ASD(HD&ASA)  formally  accepted  the  Joint  Staffs  Defense  Critical 
Asset  nomination  list  as  an  initial  list  of  Defense  Critical  Assets. 

In  its  May  2008  report  on  H.R.  5658, '  the  House  Committee  on  Armed  Services 
addressed  DOD’s  lack  of  progress  in  analyzing  the  risks  of  electrical  power  outages  to 
critical  DOD  missions  through  DCIP  and,  among  other  things,  directed  that  GAO 
continue  its  review  of  DCIP.  As  a  result,  we  initiated  our  on-going  review  of  the 
assurance  of  electrical  power  supplies  to  DOD’s  critical  assets.  We  originally  planned 
to  select  a  random  sample  of  DOD  Tier  1  Task  Critical  Assets  to  survey  for  this 
review;  however,  based  on  discussions  with  DOD  officials  and  our  analysis,  we 
determined  that  the  universe  of  critical  assets  did  not  represent  an  accurate, 
comprehensive  list  of  DOD  Tier  1  Task  Critical  Assets,  and  that  this  issue  in  and  of 
itself  warranted  further  analysis.8  Therefore,  we  are  reporting  separately  on  issues 
relating  specifically  to  the  Tier  1  Task  Critical  Asset  list  with  recommendations,  so 
DOD  can  take  action  in  a  timely  manner  to  update  and  improve  its  list  of  Defense 
Critical  Assets  in  the  fall  of  2009  and  prioritize  funding.  We  plan  to  issue  a  separate, 
related  report  later  this  year  on  our  on-going  review  of  the  assurance  of  electrical 
power  supplies  to  DOD  critical  assets. 

As  discussed  with  the  committees  of  jurisdiction  for  this  report,  we  examined  (1)  the 
extent  to  which  the  combatant  commands  and  military  services  applied  consistent 


defense  agency,  or  defense  infrastructure  sector  level.  Tier  2 — An  asset  the  loss,  incapacitation,  or 
disruption  of  which  could  result  in  severe  mission  (or  function)  degradation  at  the  DOD,  military 
department,  combatant  command,  sub-unified  command,  defense  agency,  or  defense  infrastructure 
sector  level.  Tier  3 — An  asset  the  loss,  incapacitation,  or  disruption  of  which  could  result  in  mission 
(or  function)  failure  below  the  military  department,  combatant  command,  sub-unified  command, 
defense  agency,  or  defense  infrastructure  sector  level.  ( Emphasis  added  by  GAO.') 

6  Defense  Critical  Assets  are  of  such  extraordinary  importance  to  DOD  operations  in  peace,  crisis,  and 
war  that  their  incapacitation  or  destruction  would  have  a  very  serious,  debilitating  effect  on  the  ability 
of  DOD  to  fulfill  its  missions.  Defense  critical  assets  are  a  subset  of  Tier  1  Task  Critical  Assets. 
Currently,  there  are  about  675  Tier  1  Task  Critical  Assets  and  29  Defense  Critical  Assets. 

7  H.R.  Rep.  No.  110-652,  pp.  523-524  (May  16,  2008). 

8  Although  we  found  a  number  of  duplicate  assets  on  the  Tier  1  Task  Critical  Asset  list,  combatant 
command  officials  said  that  duplication  of  Task  Critical  Assets  is  not  a  serious  issue  and  is  due  mainly 
to  the  different  naming  conventions  between  the  military  services  and  combatant  commands. 
Moreover,  combatant  command  officials  noted  that  if  several  combatant  commands  identify  an  asset 
as  a  Task  Critical  Asset,  then  this  merely  reflects  its  criticality  to  multiple  mission  owners. 
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and  clear  criteria  in  identifying  and  prioritizing  their  submissions  of  assets  to  DOD’s 
Tier  1  Task  Critical  Asset  list;  (2)  the  actions  ASD(HD&ASA)  has  taken  to  promote 
coordination  among  the  Joint  Staff,  the  combatant  commands,  and  the  military 
services  to  identify  critical  assets;  and  (3)  the  extent  to  which  ASD(HD&ASA) 
developed  effective  program  management  practices  related  to  the  identification  of 
Tier  1  Task  Critical  Assets,  such  as  formal  milestones,  schedules,  and  a  feedback 
process. 

We  focused  the  scope  of  our  review  on  DOD’s  list  of  Tier  1  Task  Critical  Assets  as  of 
March  16,  2009,  a  universe  of  about  675  assets  from  which  a  list  of  Defense  Critical 
Assets  was  developed.  9  In  addition,  Defense  Infrastructure  Sector  Lead  Agents  also 
identify  Tier  1  Task  Critical  Assets;  however,  we  did  not  include  them  in  the  scope  of 
this  review  because  they  nominated  relatively  few  assets  compared  to  the  combatant 
commands  and  military  services. 

To  evaluate  these  objectives,  we  conducted  interviews  with  DCIP  officials  at  the  U.S. 
Army,  the  U.S.  Navy,  and  the  U.S.  Air  Force;  U.S.  Pacific  Command;  U.S.  Strategic 
Command;  Joint  Staff  (J-34);  and  ASD(HD&ASA).  To  determine  the  extent  to  which 
the  combatant  commands  and  military  services  applied  consistent  and  clear  criteria 
in  identifying  and  prioritizing  their  submissions  of  assets  to  DOD’s  Tier  1  Task 
Critical  Asset  list,  we  compared  information  regarding  specific  DCIP  criteria  used 
from  our  interviews  with  the  combatant  command  and  military  service  officials  with 
prior  and  existing  DCIP  guidance,  including  the  Defense  Critical  Infrastructure 
Program  Criticality  Process  Guidance  Document;™  the  draft  Critical  Asset 
Identification  Process ,n  the  final  DOD  Manual  3020.45,  DO  I)  Mission-Based  Critical 
Asset  Identification  Process;12  DOD  Directive  3020.40; 1J  DOD  Instruction  3020.45; 14 
DCIP  strategy  documents;15  and  relevant  guidance  from  the  military  services.16  To 


9  The  actual  number  of  Tier  1  Task  Critical  Assets  can  change  frequently,  since  critical  assets  are 
regularly  added  and  deleted  from  the  list  by  the  combatant  commands,  military  services,  defense 
agencies,  and  Defense  Infrastructure  Sector  Lead  Agents. 

10  Department  of  Defense,  Defense  Critical  Infrastructure  Program  Criticality  Process  Guidance 
Document  (Dec.  21,  2006). 

11  Department  of  Defense,  Critical  Asset  Identification  Process,  Draft,  Version  2.0  (Sept.  1,  2007). 

12  DOD  3020.45-M  Volume  1  (Oct.  24,  2008). 

13  DOD  Directive  3020.40  (Aug.  19,  2005). 

14  DOD  Instruction  3020.45  (Apr.  21,  2008). 

15  These  include  the  Department  of  Defense,  Strategy  for  Defense  Critical  Infrastructure  (Washington, 
D.C.:  March  2008)  and  Department  of  Defense,  National  Defense  Strategy  (Washington,  D.C.:  June 
2008). 

16  See,  for  example,  U.S.  Air  Force,  The  Identification  of  Cri  tical  Assets  and  Infrastructures — 
Methodology,  Version  2.0  (Apr.  7,  2006);  Air  Force  Policy  Directive  10-24,  Air  Force  Critical 
Infrastructure  Program  (CIP)  (Apr.  28,  2006);  and  U.S.  Army,  Critical  Infrastructure  Risk 
Management;  The  Identification  of  Critical  Assets  Methodology  (Jan.  6,  2007). 
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determine  what  actions  ASD(HD&ASA)  has  taken  to  promote  coordination  among 
the  Joint  Staff,  the  combatant  commands,  and  the  military  services,  we  conducted 
interviews  with  appropriate  DOD  officials  regarding  steps  taken  and  planned,  and 
evaluated  the  actions  against  current  DCIP  guidance  related  to  coordination.  Finally, 
to  determine  the  extent  to  which  ASD(HD&ASA)  has  developed  effective  program 
management  practices  related  to  the  identification  of  Tier  1  Task  Critical  Assets,  such 
as  formal  milestones,  schedules,  and  a  feedback  process,  we  compared  DCIP 
program  management  strategies  and  documents  with  criteria  cited  under  our 
previous  work  on  internal  controls  in  the  federal  government. 17  We  also  interviewed 
ASD(HD&ASA)  and  Joint  Staff  officials  to  determine  what  program  management 
efforts  they  were  developing  to  identify  and  prioritize  Tier  1  Task  Critical  Assets.  We 
conducted  this  performance  audit  from  April  2009  to  June  2009  in  accordance  with 
generally  accepted  government  auditing  standards.  Those  standards  require  that  we 
plan  and  perform  the  audit  to  obtain  sufficient,  appropriate  evidence  to  provide  a 
reasonable  basis  for  our  findings  and  conclusions  based  on  our  audit  objectives.  We 
believe  that  the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives. 

Results  in  Brief 

While  DOD  has  made  some  progress  in  developing  a  Tier  1  Task  Critical  Asset  list, 
this  progress  was  limited  by  DOD’s  lack  of  consistent  criteria  for  identifying  and 
prioritizing  Tier  1  Task  Critical  Assets.  When  selecting  and  submitting  their  most 
recent  lists  of  Tier  1  Task  Critical  Asset  submissions  to  the  Joint  Staff,  the  combatant 
commands  and  the  military  services  used  disparate  sets  of  guidance,  including  draft 
and  nonbinding  guidance,  as  their  criteria.  Air  Force  officials,  however,  told  us  they 
developed  formal  critical  asset  identification  guidance  based  on  DOD’s  draft  critical 
asset  identification  manual.  According  to  military  service  and  combatant  command 
officials,  DOD’s  draft  and  nonbinding  guidance  contained  unclear  definitions  of  asset 
tiers,  Task  Critical  Assets,  and  other  key  terms,  such  as  “mission  essential  tasks.” 
Additionally,  while  DOD  encouraged  the  combatant  commands  and  military  services 
to  use  the  Criticality  Process  Guidance  Document  and  a  draft  DOD  Mission-Based 
Critical  Asset  Identification  Process  manual  to  determine  their  Tier  1  Task  Critical 
Assets,  it  did  not  require  them  to  do  so  because  DOD’s  final  DOD  Mission-Based 
Critical  Asset  Identification  Process  manual  had  not  yet  been  issued.  Our  prior  work 
on  DCIP  management18  and  the  Standards  for  Internal  Control  in  the  Federal 
Government 19  both  emphasize  the  importance  of  management  controls  to  guide 
program  implementation,  which  includes  the  development  and  issuance  of  formal 
guidance.  The  use  of  disparate  sets  of  guidance,  including  draft  and  nonbinding 


See  GAO,  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIMD-OO-21.3.1 
(Washington,  D.C.:  November  1999). 

18  GAO,  Defense  Infrastructure:  Actions  Needed  to  Guide  DOD’s  Efforts  to  Identify,  Prioritize,  and 
Assess  Its  Critical  Infrastructure,  GAO-07-461  (Washington,  D.C.:  May  24,  2007). 

19  GAO/AIMD-OO-21.3.1. 
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guidance,  resulted  in  the  selection  and  submission  of  assets  to  the  Tier  1  Task  Critical 
Assets  list  based  on  inconsistent  criteria,  thus  limiting  the  usefulness  of  the  Tier  1 
Task  Critical  Asset  list  to  DOD  decision-makers  in  determining  DOD’s  most  critical 
assets  and  prioritizing  funding  to  address  identified  vulnerabilities.  In  October  2008, 
DOD  formally  issued  the  current  guidance  on  the  identification  of  critical  assets — 
DOD  Manual  3020.45,  DOD  Critical  Asset  Identification  Process — that  all 
stakeholders  are  required  to  use  when  identifying  and  prioritizing  Task  Critical 
Assets.  Nevertheless,  officials  from  U.S.  Pacific  Command  and  the  Air  Force  we 
spoke  with  said  that  certain  definitions  contained  in  this  current  guidance  are  still 
subjective.  According  to  officials  from  U.S.  Pacific  Command,  as  long  as  the  process 
requires  a  determination  of  tier  levels  after  an  objective  analysis  of  missions,  mission 
essential  tasks,  and  criticality,  there  will  be  a  subjective  element  to  certain 
definitions.  Based  on  our  analysis  of  the  guidance  and  discussions  with  various 
officials,  elements  within  those  definitions  may  need  to  be  further  clarified.  For 
example,  Air  Force  officials  stated  that  determining  what  constitutes  a  mission 
essential  task  for  combatant  command  missions  is  a  continuing  challenge.  In 
discussions  with  us,  ASD(HD&ASA)  and  Joint  Staff  officials  acknowledged  that  the 
critical  asset  identification  process  is  still  subjective.  In  the  absence  of  consistent  and 
clear  definitions  for  determining  appropriate  asset  tiers  and  asset  criticality, 
combatant  commands  and  military  services  applied  definitions  of  Tier  1  Task  Critical 
Assets  inconsistently  and,  going  forward,  may  continue  to  do  so  until  these 
definitions  are  further  clarified. 

DOD  has  taken  some  actions  toward  promoting  coordination  among  the  combatant 
commands,  military  services,  and  Joint  Staff  in  compiling  DOD’s  Tier  1  Task  Critical 
Asset  list.  For  example,  in  August  2005,  DOD  issued  DOD  Directive  3020.40,  which 
calls  for  coordination  among  the  Joint  Staff,  combatant  commands,  military  services, 
and  other  defense  agencies  for  the  purpose  of  identifying  and  assessing  critical  assets 
needed  to  implement  DOD  missions.  Additionally,  in  October  2008,  DOD  issued  DOD 
Manual  3020.45,  which  defines  the  combatant  command,  military  service,  and  Joint 
Staff  roles  in  the  critical  asset  identification  process.  However,  DOD  has  not  yet 
developed  formal  coordination  responsibilities  and  an  effective  coordination 
mechanism  within  DCIP,  including  a  forum  for  coordination  between  the  military 
services  and  combatant  commands  when  identifying  critical  assets.  Combatant 
command  and  military  service  officials  told  us  that,  in  considering  which  assets  to 
submit  to  DOD’s  Tier  1  Task  Critical  Asset  list,  they  coordinate  only  minimally  with 
each  other  when  determining  which  assets  are  critical  to  combatant  command 
missions.  Based  on  our  analysis  of  the  October  2008  manual  and  discussions  with 
DCIP  officials,  we  found  that  the  Joint  Staff,  combatant  commands,  military  services, 
and  other  DOD  agencies  still  lack  clearly  defined  coordination  responsibilities  and  a 
mechanism  for  effective  coordination  within  DCIP.  As  a  result,  the  communication 
and  coordination  efforts  among  these  key  DCIP  stakeholders  when  considering 
assets  to  nominate  as  Tier  1  Task  Critical  Assets  have  been  insufficient  and 
inconsistent.  For  example,  Army  officials  stated  they  were  unaware  that  an  Army- 
related  critical  asset  was  submitted  as  a  Defense  Critical  Asset  during  the  previous 
data  call  and  did  not  know  who  submitted  it.  Army  officials  think  this  will  continue  to 
be  a  problem  under  the  new  asset  identification  process.  This  is  important  because 
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the  asset  owner — the  Army  in  this  case — typically  uses  this  information  to  help 
develop  strategies  to  mitigate  risks  and  provide  funding  to  address  the  asset’s 
identified  vulnerabilities.  Officials  we  spoke  with  from  all  three  military  services 
stated  that  lack  of  coordination  with  the  combatant  commands  to  identify  task 
critical  assets  may  continue.  Joint  Staff  officials  also  acknowledged  that  coordination 
needs  to  be  strengthened  between  the  military  services  and  combatant  commands. 
Without  effective  coordination,  the  Joint  Staff,  combatant  commands,  and  military 
services  cannot  agree  on  an  accurate  identification  and  prioritization  of  assets  most 
critical  to  fulfilling  combatant  commands’  missions  or  reach  agreement  on  how  to 
prioritize  funding  to  help  develop  effective  actions  to  protect  and  mitigate  against 
possible  attacks  on  DOD’s  critical  infrastructure. 

While  DOD  has  developed  a  strategy  and  comprehensive  management  plan  for  DCIP, 
it  has  not  fully  developed  some  DCIP  program  management  elements  for  identifying 
Tier  1  Task  Critical  Assets,  which  could  enhance  the  effectiveness  of  the  program. 
DOD  Directive  3020.40  requires  ASD(HD&ASA) — the  lead  office  for  DCIP — to 
develop  and  ensure  the  implementation  of  DCIP  policy  and  program  guidance  for  the 
identification,  prioritization,  and  protection  of  defense  critical  infrastructure.  This 
directive  also  requires  the  Joint  Staff  to  assist  ASD(HD&ASA)  in  the  development  and 
maintenance  of  DCIP  standards.  DOD’s  formal  critical  asset  identification  process 
manual  issued  in  2008  lacks  some  key  elements  necessary  for  sound  program 
management,  including  clearly  defined  schedules  and  milestones  for  meeting 
performance  goals  and  a  formal  feedback  process.  According  to  our  work  on  sound 
management  practices,  comprehensive  program  schedules  and  formal 
communication  strategies  assist  agencies  in  effectively  implementing  programs  by 
providing  relevant  stakeholders  with  timelines  to  follow,  performance  milestones  to 
meet,  and  shared  expectations  to  guide  their  efforts.  Because  DOD  lacks  a  formal 
process  for  submitting  critical  assets,  including  milestones  and  formal  feedback  from 
ASD(HD&ASA)  or  the  Joint  Staff  on  meeting  program  goals,  the  combatant 
commands  and  military  services  are  limited  in  their  ability  to  effectively  select, 
compile,  and  validate  their  final  nominations  to  DOD’s  Tier  1  Task  Critical  Asset  list. 
For  example,  according  to  the  combatant  command  and  military  service  officials  we 
spoke  with,  the  Joint  Staff  asked  them  to  submit  their  final  nominations  for  DOD's 
Tier  1  Task  Critical  Asset  list  in  2008  with  relatively  little  prior  notice.  As  a  result, 
these  officials  expressed  concern  that  they  did  not  receive  adequate  time  to  develop 
their  submissions  thoroughly  or  accurately,  and  that  they  did  not  receive  any  formal 
feedback  from  the  Joint  Staff  once  their  lists  were  submitted.  Recognizing  this 
problem,  ASD(HD&ASA)  officials  told  us  that  they  are  planning  to  develop  a  formal 
schedule  for  the  combatant  commands  and  military  services  to  follow  in  developing 
their  Tier  1  Task  Critical  Asset  submissions.  However,  until  ASD(HD&ASA)  finalizes 
and  formally  issues  this  schedule,  there  may  continue  to  be  discrepancies  in  the 
expectations  among  the  combatant  commands,  military  services,  and  the  Joint  Staff 
regarding  the  timeframes  for  submitting  assets.  As  a  result,  DOD’s  Tier  1  Task  Critical 
Asset  list  may  continue  to  include  assets  that  should  not  be  on  the  list,  or  exclude 
assets  that  should  be  on  the  list  if  the  services  and  combatant  commands  are  not 
allowed  sufficient  notice  or  time  for  completing  their  asset  submissions.  In  addition, 
without  formal  feedback  from  the  Joint  Staff  on  how  DCIP  stakeholders  are  adhering 
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to  program  guidelines,  the  combatant  commands  and  military  services  may  not  be 
aware  that  some  of  their  asset  submissions  to  the  Tier  1  Task  Critical  Asset  list  do  not 
conform  to  DCIP  criteria. 

We  are  recommending  that  ASD(HD&ASA)  clarify  key  elements  within  the  DCIP 
definitions  of  a  Task  Critical  Assets,  formalize  coordination  responsibilities  and 
mechanisms  within  DCIP,  and  develop  processes  for  compiling  the  Tier  1  Task 
Critical  Asset  list,  including  the  development  of  a  formal  schedule  with  timelines  and 
milestones  and  a  formal  feedback  process  for  key  DCIP  stakeholders  when 
identifying  and  prioritizing  critical  assets  for  submission  to  the  Tier  1  Task  Critical 
Asset  list. 

In  written  comments  on  a  draft  of  this  report,  DOD  partially  concurred  with  all  three 
of  our  recommendations.  For  each  recommendation,  DOD  described  relevant 
guidance  in  place  or  in  draft  and  additional  actions  it  would  take  in  response.  Our 
responses  to  these  comments  are  presented  in  the  Agency  Comments  and  Our 
Evaluation  section  of  this  report,  and  DOD’s  comments  are  reprinted  in  enclosure  I. 
We  also  received  technical  comments  from  U.S.  Pacific  Command,  and  we 
incorporated  these  as  appropriate. 

Background 

In  response  to  the  guidance  contained  in  Homeland  Security  Presidential  Directive 
7,“°DOD  formalized  its  critical  infrastructure  efforts  in  August  2005  by  issuing  DOD 
Directive  3020.40,  Defense  Critical  Infrastructure  Program  (DCIP),  which 
established  the  program  and  assigned  overall  responsibility  to  ASD(HD&ASA).  DOD 
Directive  3020.40  requires,  among  other  things,  that  ASD(HD&ASA)  develop  and 
ensure  implementation  of  DCIP  policy  and  program  guidance  for  the  identification, 
prioritization,  and  protection  of  defense  critical  infrastructure. 

Under  DCIP,  ASD(HD&ASA)  and  the  Joint  Staff  have  tasked  the  combatant 
commands,  military  services,  and  Defense  Infrastructure  Sector  Lead  Agents  with 
nominating  infrastructure  necessary  to  accomplish  the  goals  specified  in  the 
National  Defense  Strategy.11  The  combatant  commands,  in  collaboration  with  the 
Joint  Staff,  identify  and  prioritize  DOD  missions  that  are  the  basis  for  determining 
infrastructure  criticality,  while  the  military  services,  as  the  principal  owners  of  DOD 
infrastructure,  identify  and  link  infrastructure  to  the  specific  mission  requirements  of 
the  combatant  commands  in  coordination  with  defense  infrastructure  lead  agents. 
Based  on  these  efforts,  the  combatant  commands  and  military  services  then  nominate 


20  Homeland  Security  Presidential  Directive  7,  issued  in  December  2003,  requires,  among  other 
things,  that  all  federal  departments  and  agencies  identify,  prioritize,  and  coordinate  the  protection  of 
critical  infrastructure  and  key  resources  from  terrorist  attacks.  DCIP  encompasses  the  full  spectrum  of 
threats — ranging  from  terrorist  attacks  to  natural  disasters  and  catastrophic  accidents — that  can 
adversely  affect  critical  defense  infrastructure. 

21  Department  of  Defense,  The  National  Defense  Strategy  of  the  United  States  of  America 
(Washington,  D.C.:  June  2008). 
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assets  to  DOD’s  consolidated  draft  critical  asset  list,  which  ASD(HD&ASA)  uses  as 
the  basis  for  developing  a  final  Task  Critical  Asset  list  and  the  Defense  Critical  Asset 
list. 

According  to  DCIP  guidance  for  identifying  defense  critical  infrastructure,  the 
process  used  by  DCIP  stakeholders  provides  a  consistent,  repeatable,  mission- 
focused  analysis  process  to  identify  Task  Critical  Assets  and  an  effects-based  analysis 
to  identify  Defense  Critical  Assets  from  the  list  of  Tier  1  Task  Critical  Assets.  A  Task 
Critical  Asset  is  an  asset  of  such  extraordinary  importance  that  its  incapacitation  or 
destruction  would  have  a  very  serious  debilitating  effect  on  the  ability  of  DOD,  a 
military  department,  combatant  command,  sub-unified  command,  defense  agency,  or 
Defense  Infrastructure  Sector  Lead  Agent  to  execute  the  task  that  the  asset  supports. 
In  October  2008,  DOD  issued  DOD  Manual  3020.45  that  outlined  a  process  for  the 
combatant  commands,  the  military  services,  the  Defense  Infrastructure  Sector  Lead 
Agents,  and  other  DOD  organizations  to  follow  when  identifying  assets  for 
submission  as  DOD  Task  Critical  Assets.  This  process  results  in  a  DOD-wide  list  of 
Task  Critical  Assets  that  are  tiered  into  three  groups  (Tier  1,  Tier  2,  and  Tier  3)  based 
on  the  criticality  of  their  supported  missions.  The  manual  then  tasks  the  Chairman  of 
the  Joint  Chiefs  of  Staff  to  recommend  a  list  of  DOD  Defense  Critical  Assets — 
selected  from  the  Tier  1  Task  Critical  Asset  list — to  ASD(HD&ASA)  for  review  and 
approval. 

ASD(HD&ASA)  has  issued  numerous  documents  with  guidance  related  to  DCIP, 
including  DOD  directives,  manuals,  and  instructions.  Figure  1  illustrates  the  timeline 
of  issuance  of  key  pieces  of  DCIP  guidance  related  to  the  identification  of  Task 
Critical  Assets  and  Defense  Critical  Assets. 

Figure  1:  Timeline  of  Issuance  of  Key  DCIP  Guidance 
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DOD  releases  the  draft 
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September  2003: 
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December  2006: 

DOD  releases  the  DCIP 
Defense  Critical  Infrastructure 
Program  Critical  Process  Guide 


May  2007: 

DOD  releases  the 
DCIP  Security 
Classification  Manual 


October  2008: 

DOD  issues 

DOD  Manual  3020.45.  Vol.1,  DOD  Critical 
Asset  Identification  Process 


Source:  GAO  analysis  of  DOD  documents. 


DOD  Lacks  Consistent  Criteria  for  Identifying  and  Prioritizing  Critical 
Assets  to  Develop  Its  Tier  1  Task  Critical  Asset  List 

While  DOD  has  made  some  progress  in  developing  an  evolving  Tier  1  Task  Critical 
Asset  list,  this  progress  has  been  limited  by  DOD’s  lack  of  consistent  criteria, 


Page  8 


GAO-09-740R  Defense  Infrastructure 


including  unclear  definitions,  for  identifying  and  prioritizing  Tier  1  Task  Critical  Asset 
nominations.  The  Joint  Staff  formally  requested  submissions  of  task  critical  assets 
from  the  military  services,  combatant  commands,  and  other  DCIP  stakeholders  in 
January  2007,  and  early  in  2008,  the  Joint  Staff  asked  that  the  military  services  and 
combatant  commands  update  their  list  of  their  Tier  I  Task  Critical  Assets.  However, 
the  combatant  commands  and  military  services  used  different  sets  of  guidance, 
including  draft  and  non-binding  guidance,  as  criteria  during  their  identification  and 
prioritization  processes  for  their  Tier  1  Task  Critical  Asset  submissions.  For  example, 
DCIP  officials  at  U.S.  Pacific  Command,  the  Army,  the  Air  Force,  and  the  Navy  told  us 
they  had  used  internally  developed  guidance  to  identify  and  prioritize  their  Tier  1 
Task  Critical  Asset  nominations,  while  U.S.  Strategic  Command  officials  said  that 
they  had  used  the  draft  version  of  the  DOD  Critical  Asset  Identification  Process 
manual  that  was  available  during  the  2007  data  call  to  develop  their  submissions.  Air 
Force  officials  also  told  us  they  developed  formal  critical  asset  identification 
guidance  based  on  DOD’s  draft  critical  asset  identification  manual.  Based  on  our 
review  of  the  various  forms  of  guidance,  the  definitions  were  varied  for  Tier  1  and 
Task  Critical  Assets  and  some  versions  of  the  guidance  did  not  contain  definitions  for 
Tier  1.  Similarly,  for  their  nominations  to  the  most  recent  Tier  1  Task  Critical  Asset 
list  compiled  in  2008,  the  combatant  commands  and  military  services  continued  to 
use  different  sets  of  draft  and  non-binding  guidance  as  criteria  for  selection  and 
submission  of  assets  to  the  Joint  Staff,  since  ASD(HD&ASA)  had  not  yet  finalized  the 
DOD  Critical  Asset  Identification  Process  Manual. 

In  addition,  according  to  various  combatant  command  and  military  service  officials, 
the  draft  and  non-binding  guidance  also  contained  unclear  definitions  for  Task 
Critical  Assets  and  for  Tier  1  Task  Critical  Assets.  In  our  discussions  with  officials 
from  the  U.S.  Pacific  Command,  the  military  services,  and  the  Joint  Staff,  these 
officials  explained  that  the  definitions  for  a  Task  Critical  Asset  and  for  a  Tier  1  Task 
Critical  Asset  contained  in  the  draft  and  non-binding  guidance  were  subjective  and 
could  be  interpreted  differently  by  combatant  commands  or  military  services  based 
on  their  respective  missions.  For  example,  officials  from  one  military  service  stated 
that  they  were  not  sure  why  certain  assets  they  owned  were  nominated  by  a 
combatant  command.  Combatant  command  officials  also  acknowledged  this  and 
added  the  value  of  an  asset  to  a  combatant  command  mission  may  not  be  readily 
apparent  to  asset  owners  at  DOD  installations.  DCIP  officials  from  the  Army,  the  Air 
Force,  and  the  Navy  told  us  that  clearer  descriptions  of  the  combatant  commands’ 
mission  essential  tasks — which  are  used  to  identify  Task  Critical  Assets — would 
improve  the  critical  asset  identification  process  for  DCIP.  The  military  services  use 
information  about  tasks  essential  to  completing  combatant  command  missions  to 
help  them  identify  their  potential  submissions  to  the  Tier  1  Task  Critical  Asset  list  by 
providing  specific  information  about  combatant  command  missions  that  they  use  to 
identify  assets  needed  for  those  missions.  For  example,  Air  Force  officials  said  they 
have  a  lot  of  knowledge  regarding  tasks  needed  to  complete  their  Air  Force-specific 
missions,  but  do  not  always  have  similar  knowledge  of  combatant  command 
missions.  According  to  these  officials,  the  military  services  typically  obtain 
combatant  command  mission  task  information  from  the  Defense  Readiness  Reporting 
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System/"  as  the  combatant  commands  do  not  provide  this  detailed  information 
directly  to  the  military  services.  However,  Air  Force  and  Navy  officials  stated  that  this 
information  is  often  inconsistent.  Better  developed  information  about  tasks  essential 
to  completing  combatant  command  missions,  including  standards  and  conditions  to 
determine  what  constitutes  a  mission  failure  or  mission  degradation, 23  would  provide 
additional  clarity  in  identifying  and  prioritizing  Task  Critical  Assets. 

In  the  absence  of  formal  DCIP  guidance  on  the  critical  asset  identification  process, 
ASD(HD&ASA)  encouraged,  but  did  not  require,  the  combatant  commands  and 
military  services  to  use  their  draft  and  non-binding  guidance  to  identify  and  prioritize 
their  Tier  1  Task  Critical  Asset  submissions  in  2007  and  2008.  This  guidance  included 
the  Criticality  Process  Guidance  Document ,  issued  in  December  2006,  and  the  draft 
version  of  the  DOD  Critical  Asset  Identification  Process  manual,  issued  in 
September  2007. 

Our  prior  work  on  DCIP  management"4  and  the  Standards  for  Internal  Control  in  the 
Federal  Government25  both  emphasize  the  importance  of  management  controls  to 
guide  program  implementation,  which  includes  the  development  and  issuance  of 
formal  guidance.  Based  on  discussions  with  combatant  command  and  military  service 
officials,  the  lack  of  consistent  criteria,  including  varying  definitions  of  key  terms,  in 
the  selection  of  Tier  1  Task  Critical  Asset  submissions  and  the  absence  of  binding 
guidance  from  ASD(HD&ASA)  have  resulted  in  a  Tier  1  Task  Critical  Asset  list  of 
limited  usefulness  to  decision-makers  in  determining  DOD’s  most  critical  assets. 
Specifically,  the  list  may  continue  to  include  assets  that  should  not  be  on  the  list. 

Also,  as  noted  in  our  prior  work,  the  absence  of  formal  DCIP  guidance  and  policies 
has  led  DOD  components,  such  as  the  combatant  commands  and  military  services,  to 
pursue  varying  approaches  to  identify  and  ensure  the  availability  of  their  critical 
assets.  ASD(HD&ASA)  and  Joint  Staff  officials  acknowledged  that  the  current  version 
of  the  Tier  1  Task  Critical  Asset  list  is  problematic  and  that  they  expect  the  current 
list  of  Tier  1  Task  Critical  Assets  to  change  significantly  over  the  next  year  because 
the  military  services  and  combatant  commands  are  now  required  to  use  formal 
critical  asset  identification  criteria  to  submit  an  update  to  their  Tier  1  Task  Critical 
Asset  lists.  ASD(HD&ASA)  officials  believe  the  use  of  this  new  guidance  will  improve 
the  quality  of  the  list. 


22  The  Defense  Readiness  Reporting  System  is  a  real-time  information  system  that  measures  and 
reports  on  the  readiness  of  military  forces  and  the  supporting  infrastructure  to  meet  missions  and 
goals  assigned  by  the  Secretary  of  Defense. 

23  According  to  the  DOD  Critical  Asset  Identification  Process  manual,  a  Tier  1  Task  Critical  Asset  is 
defined  by  mission  failure  if  the  asset  is  lost,  incapacitated,  or  disrupted.  However,  a  Tier  2  Task 
Critical  Asset  is  defined  by  severe  mission  (or  function)  degradation  if  the  asset  is  lost,  incapacitated, 
or  disrupted. 

24  GAO-07-461. 

25  GAO/AIMD-OO-2 1.3.1. 
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DOD  issued  the  final  version  of  the  DOD  Critical  Asset  Identification  Process 
manual  in  October  2008.  However,  officials  from  the  Air  Force  and  U.S.  Pacific 
Command  we  spoke  with  said  that  certain  definitions  contained  in  this  current 
guidance  are  still  subjective  and  elements  within  those  definitions  still  need  to  be 
clarified.  For  example,  Air  Force  officials  stated  that  determining  what  constitutes  a 
mission  essential  task  for  combatant  command  missions  is  a  continuing  challenge.  In 
addition,  U.S.  Pacific  Command  officials  explained  that  tiering  critical  assets  is  an 
inherently  subjective  process  with  asset  and  mission  owners  relying  on  their  own 
individual  perspectives  and  interpretations  of  the  definitions  to  determine  the 
appropriate  tier  of  an  asset.  For  example,  military  services  typically  have  different 
mission-essential  tasks  and,  in  some  cases,  the  military  services  will  assign  the  same 
asset  to  different  tier  levels.  In  discussions  with  us,  ASD(HD&ASA)  and  Joint  Staff 
officials  acknowledged  that  the  critical  asset  identification  process  is  still  subjective 
and  further  clarification  may  be  needed.  Though  DOD  has  issued  the  final  version  of 
the  DOD  Critical  Asset  Identification  Process  manual,  based  on  our  analysis  of  this 
manual  and  discussions  with  military  service  and  combatant  command  officials, 
further  clarification  of  the  tier  definitions  and  certain  elements  within  those 
definitions  may  be  warranted  to  prevent  future  inconsistencies  in  the  combatant 
commands’  and  the  military  services’  submissions  of  assets  to  DOD’s  Tier  1  Task 
Critical  Asset  list. 

DOD  Has  Taken  Steps  to  Promote  Coordination  among  Key  DCIP 
Stakeholders  but  Still  Lacks  an  Effective  Coordination  Mechanism  for 
Identifying  and  Nominating  Critical  Assets 

DOD  has  taken  some  actions  toward  promoting  coordination  among  the  combatant 
commands,  military  services,  and  the  Joint  Staff  in  developing  DOD’s  Tier  1  Task 
Critical  Asset  list,  such  as  issuing  the  October  2008  DCIP  critical  asset  identification 
guidance.  However,  it  has  not  yet  developed  formal  coordination  responsibilities  and 
an  effective  coordination  mechanism  within  DCIP,  including  a  forum  for  coordination 
between  the  military  services  and  combatant  commands  when  identifying  critical 
assets.  According  to  combatant  command  and  military  service  officials,  they  conduct 
minimal  coordination  when  determining  which  assets  are  critical  to  combatant 
command  missions — a  key  step  in  identifying  assets  to  nominate  to  DOD’s  Tier  1 
Task  Critical  Asset  list.  In  addition,  Navy  and  Army  officials  stated  they  only 
coordinate  minimally  with  the  Joint  Staff  once  they  submit  their  assets  for  the  Tier  1 
Task  Critical  Asset  list.  Combatant  commands  are  charged  in  the  DCIP  guidance  with 
conducting  analyses  of  command  mission  and  mission  essential  tasks  with  their 
associated  conditions  and  standards  and  providing  the  results  of  these  analyses  to  the 
appropriate  DCIP  stakeholders  to  support  Task  Critical  Asset  identification.  In 
contrast,  the  military  services  own  most  of  the  assets  and,  in  some  cases,  are 
responsible  for  providing  resources,  such  as  funding,  to  protect  those  assets,  thereby 
assuring  the  capabilities  needed  to  implement  missions.  Consequently,  the  combatant 
commands  and  military  services  each  have  a  role  in  identifying  and  prioritizing 
critical  assets  through  DCIP. 
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In  August  2005,  DOD  issued  DOD  Directive  3020.40,  which  calls  for  coordination 
among  the  combatant  commands,  military  services,  the  Joint  Staff,  and  other  DOD 
agencies  for  the  purpose  of  identifying  and  assessing  critical  assets  needed  to 
implement  combatant  command  missions.  Additionally,  in  October  2008,  DOD  issued 
DOD  Manual  3020.45,  which  further  defines  combatant  command,  military  service, 
and  Joint  Staff  roles  in  the  critical  asset  identification  process.  However,  based  on 
our  analysis  of  the  October  2008  manual  and  discussions  with  DCIP  officials,  DCIP 
continues  to  lack  clearly  defined  coordination  responsibilities  and  a  mechanism  for 
effective  coordination  within  the  program  among  the  combatant  commands  and 
military  services.  As  a  result,  the  communication  and  coordination  efforts  among 
these  key  DCIP  stakeholders  are  insufficient  and  inconsistent,  which  hinders  the 
ability  of  the  military  services  to  identify  critical  assets  needed  to  fulfill  combatant 
command  missions. 

Officials  we  spoke  with  from  all  three  military  services  stated  that,  while  the  new 
guidance  outlines  a  critical  asset  identification  process,  lack  of  coordination  with  the 
combatant  commands  may  continue.  Military  service  officials  rely  on  the  combatant 
commands  to  provide  detailed  information  about  their  missions  to  help  the  military 
services  identify  critical  assets.  For  example,  Air  Force  officials  told  us  that  they  rely 
on  combatant  commands  to  provide  them  with  combatant  command-related  mission 
essential  task  information,  but  that  this  information  is  not  always  accurately  and 
consistently  provided  by  the  combatant  commands.  Similarly,  Army  officials  stated 
they  were  unaware  of  the  submission  of  a  particular  Army-owned  critical  asset  by  a 
combatant  command  to  the  Tier  1  Task  Critical  Asset  list — and  its  subsequent 
selection  as  a  Defense  Critical  Asset — during  the  previous  Joint  Staff  data  call  for 
Task  Critical  Asset  submissions  until  the  Army  officials  viewed  the  final  Tier  1  Task 
Critical  Asset  list.  According  to  these  Army  officials,  their  lack  of  awareness  of  this 
asset’s  status  as  a  Defense  Critical  Asset  hindered  their  ability  to  develop  and  share 
effective  risk  mitigation  strategies  for  this  asset  with  senior  Army  leaders.  Air  Force 
and  Army  officials  stated  that  the  new  guidance  will  not  specifically  address  these 
coordination  issues. 

ASD(HD&ASA)  and  Joint  staff  officials  acknowledge  that  DCIP-related  coordination 
between  the  combatant  commands  and  military  services  could  be  strengthened. 
Officials  at  U.S.  Strategic  Command  stated  they  are  in  the  process  of  developing  an 
electronic  information  sharing  field  within  the  critical  asset  database  used  to  track 
DOD’s  Task  Critical  Assets  for  DCIP.  U.S.  Strategic  Command  manages  the  database 
used  to  track  DOD’s  critical  assets.  These  officials  also  told  us  that  this  information 
sharing  mechanism  may  help  the  combatant  commands,  military  services,  and  the 
Joint  Staff  improve  their  coordination  efforts,  but  that  this  mechanism  has  not  yet 
been  finalized  and  is  still  being  tested  within  the  DCIP  community.  Until 
ASD(HD&ASA)  formalizes  coordination  responsibilities  among  key  DCIP 
stakeholders  and  develops  an  effective  coordination  mechanism,  coordination  among 
the  combatant  commands,  military  services,  and  the  Joint  Staff  for  DCIP  will 
continue  to  be  limited.  Without  effective  coordination,  the  Joint  Staff,  combatant 
commands,  and  military  services  cannot  agree  on  an  accurate  identification  and 
prioritization  of  assets  most  critical  to  fulfilling  combatant  commands’  missions  or 
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reach  agreement  on  how  to  prioritize  funding  to  help  develop  effective  actions  to 
protect  and  mitigate  against  possible  attacks  on  DOD’s  critical  infrastructure. 

DCIP  Lacks  Some  Key  Program  Elements  Needed  to  Facilitate  the  Critical 
Asset  Identification  and  Prioritization  Process 

While  DOD  has  developed  a  strategy  and  a  comprehensive  management  plan  for 
managing  DCIP  and  issued  a  new  DOD  Mission-Based  Critical  Asset  Identification 
Process  manual,26  DCIP  still  lacks  certain  key  elements  for  nominating  Tier  1  Task 
Critical  Assets,  which  could  enhance  the  effectiveness  of  the  program,  including 
development  of  clearly  defined  schedules  for  meeting  performance  goals  and  a 
formal  feedback  process.  According  to  our  work  on  sound  management  practices,27 
comprehensive  program  schedules  and  formal  communication  strategies  assist 
agencies  in  effectively  implementing  programs  by  providing  relevant  stakeholders 
with  timelines  to  follow,  performance  milestones  to  meet,  and  shared  expectations  to 
guide  their  efforts.  To  date,  the  Joint  Staff  has  not  requested  Tier  1  Task  Critical  Asset 
submissions  from  the  combatant  commands  and  military  services  using  a  routine  and 
consistent  timeline  with  milestones.  Instead,  the  Joint  Staff  has  requested  asset 
submissions  from  the  combatant  commands  and  military  services  primarily  on  an  ad- 
hoc  basis,  without  providing  a  formal  schedule  or  deadlines  for  the  responsible 
organizations  to  follow.  Subsequently,  the  military  services  expressed  concern  that 
they  were  not  allowed  adequate  time  to  generate  thorough  and  accurate  nominations 
for  DOD’s  Tier  1  Task  Critical  Asset  list  prior  to  the  required  2008  deadline  for 
submission  to  the  Joint  Staff.  For  example,  according  to  the  combatant  command  and 
military  service  officials  with  whom  we  spoke,  the  Joint  Staff  asked  them  to  submit 
their  final  nominations  for  DOD's  Tier  1  Task  Critical  Asset  list  in  2008  with  relatively 
little  prior  notice.  As  a  result,  these  officials  expressed  concern  that  they  did  not 
receive  adequate  time  to  develop  their  submissions  thoroughly  or  accurately. 
Furthermore,  Air  Force  and  U.S.  Pacific  Command  officials  expect  their  future 
processes  for  generating  more  accurate  Tier  1  Task  Critical  Asset  submissions  to 
take,  on  average,  a  total  of  18  months  and  3  years,  respectively.  However, 
ASD(HD&ASA)  and  Joint  Staff  officials  indicated  they  hope  to  revise  the  current  Tier 
1  Task  Critical  Asset  list  using  the  new  DCIP  critical  asset  identification  process  in 
approximately  4  months,  or  by  October  2009.  However,  until  ASD(HD&ASA)  clarifies 
a  timeline  and  milestones  for  submitting  critical  assets  to  the  combatant  commands 
and  military  services,  there  may  continue  to  be  discrepancies  in  the  expectations 
among  the  combatant  commands,  military  services,  and  the  Joint  Staff  regarding  the 
expected  timeframes  for  submitting  assets.  As  a  result,  DOD’s  Tier  1  Task  Critical 
Asset  list  may  continue  to  include  assets  that  should  not  be  on  the  list,  or  exclude 
assets  that  should  be  on  the  list  if  the  services  and  combatant  commands  are  not 
allowed  sufficient  notice  or  time  for  completing  asset  submissions. 


DOD  3020.45-M  Volume  1  (Oct.  24,  2008). 
GAO/AIMD-OO-2 1.3.1. 
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DCIP  guidance  does  not  contain  a  process  for  providing  formal  feedback  to  the 
combatant  commands  and  military  services  regarding  their  selection  of  assets  for  the 
Tier  1  Task  Critical  Asset  list.  Based  on  discussions  with  combatant  command, 
military,  and  Joint  Staff  officials,  only  minimal  informal  feedback  has  occurred  to 
date.  Our  prior  work,  including  Standards  for  Internal  Control  in  the  Federal 
Government, 28 emphasizes  the  need  for  formal  feedback  as  a  management  control. 
The  lack  of  formal  feedback  from  the  Joint  Staff  may  result  in  a  Tier  1  Task  Critical 
Asset  list  that  includes  inappropriate  assets  that  do  not  meet  DOD  criteria.  For 
example,  Army,  Navy,  and  Air  Force  officials  we  spoke  with  stated  they  would  find 
formal  feedback  useful  when  submitting  future  nominations  for  the  DOD  Tier  1  Task 
Critical  Asset  list  to  the  Joint  Staff.  Without  any  formal  feedback,  the  combatant 
commands  and  military  services  may  continue  to  either  submit  assets  for  the  Tier  1 
Task  Critical  Asset  lists  that  should  not  be  on  the  list  or  may  exclude  assets  that 
should  be  on  the  list  from  their  submissions.  As  a  result,  DOD’s  Tier  1  Task  Critical 
Asset  list  maintained  by  the  Joint  Staff  may  continue  to  include  assets  that  are  not 
appropriate.  Without  fully  developed  timelines  for  data  submissions  and  a  formal 
feedback  process  regarding  those  submissions  within  DCIP,  combatant  commands 
and  military  services  might  not  accurately  identify  the  assets  most  critical  to  their 
missions  and  make  fully  informed  budgetary  and  resource  allocation  decisions 
necessary  to  protect  those  assets  from  possible  threats  or  hazards. 

Conclusions 

DOD’s  recent  issuance  of  DOD  Manual  3020.45  Volume  1,  DOD  Critical  Asset 
Identification  Process,  is  a  positive  step  toward  developing  a  consistent  and  reliable 
Tier  1  Task  Critical  Asset  list;  however,  further  action  is  needed.  Having  a  complete 
and  reliable  list  of  prioritized  and  assessed  critical  assets  will  enable  DOD  to  target 
resources  to  its  most  mission-critical  assets  at  highest  risk.  Subjectivity  and  a  lack  of 
clarity  regarding  the  appropriate  guidance  to  clarify  key  definitions  may  continue  to 
result  in  inappropriate  assets  being  nominated  by  the  combatant  commands  and 
military  services,  and  prevent  DOD  from  having  a  complete  and  accurate  list  of 
critical  assets.  DOD  officials  acknowledged  that  the  current  definitions  of  Task  1  and 
Task  Critical  Asset  are  subjective.  Also,  until  coordination  within  the  program  is 
formalized  and  strengthened,  the  military  services,  combatant  commands,  and  the 
Joint  Staff  may  not  be  in  a  position  to  coordinate  effectively  with  each  other  to 
determine  which  assets  are  most  critical  to  DOD  and  levels  of  funding  to  address 
identified  vulnerabilities.  Finally,  while  DOD  has  made  progress  in  issuing  a  strategy 
for  critical  infrastructure,  DOD’s  lack  of  effective  program  management  practices 
may  continue  to  limit  the  program’s  effectiveness  in  identifying  and  prioritizing 
critical  assets. 


GAO/AIMD-OO-2 1.3.1. 
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Recommendations  for  Executive  Action 


We  are  recommending  that  the  Secretary  of  Defense  take  the  following  three  actions: 

•  To  improve  the  consistency  and  reliability  of  the  Tier  1  Task  Critical  Asset  list, 
direct  the  Assistant  Secretary  of  Defense  for  Homeland  Defense  and  Americas’ 
Security  Affairs  and  the  Joint  Staff  to  further  clarify  the  definitions  of  a  Tier  1 
Task  Critical  Asset  contained  in  DOD  Manual  3020.45  Volume  I,  Critical  Asset 
Identification  Process,  along  with  definitions  of  key  elements,  such  as  “mission 
essential  tasks.”  Potential  approaches  could  include  establishing  and  issuing  a  set 
of  test  questions  to  apply  to  a  proposed  critical  asset  or  providing  a  set  of 
hypothetical  examples  to  use  in  identifying  critical  assets. 

•  To  facilitate  effective  coordination  among  the  combatant  commands,  military 
services,  and  the  Joint  Staff  in  compiling  the  Tier  1  Task  Critical  Asset  list,  direct 
the  Assistant  Secretary  of  Defense  for  Homeland  Defense  and  Americas’  Security 
Affairs  and  the  Joint  Staff  to  develop  specific  coordination  responsibilities  and  a 
coordination  mechanism  within  DCIP  for  each  of  those  stakeholders  to  use  when 
compiling  the  list. 

•  To  improve  the  overall  effectiveness  of  DOD’s  process  to  develop  a  list  of  Tier  1 
Task  Critical  Assets,  direct  the  Assistant  Secretary  of  Defense  for  Homeland 
Defense  and  Americas’  Security  Affairs  and  the  Joint  Staff  to  formalize  processes 
for  compiling  the  Tier  1  Task  Critical  Asset  list,  including  the  development  of  a 
formal  schedule  with  timelines  and  milestones  for  submitting  Tier  1  Task  Critical 
Asset  data  and  a  formal  process  for  the  Joint  Staff  to  provide  feedback  to  the 
combatant  commands  and  military  services  regarding  the  assets  they  propose  to 
include  on  the  Tier  1  Task  Critical  Asset  list. 

Agency  Comments  and  Our  Evaluation 

In  written  comments  on  a  draft  of  this  report,  which  included  three  draft 
recommendations,  DOD  partially  concurred  with  all  three  of  our  recommendations. 
For  each  recommendation,  DOD  described  relevant  guidance  in  place  or  in  draft  and 
additional  actions  it  would  take  in  response.  Also,  U.S.  Pacific  Command  provided 
technical  comments,  which  we  incorporated  in  the  report  where  appropriate.  DOD’s 
comments  are  reprinted  in  enclosure  I. 

DOD  partially  concurred  with  our  first  recommendation,  which  called  for 
clarification  of  definitions  of  a  Tier  1  and  a  Task  Critical  Asset,  and  elements  within 
those  definitions.  In  its  written  comments,  DOD  stated  that  Manual  3020.45  Volume  1, 
Mission-Based  Critical  Asset  Identification  Process  provides  comprehensive 
procedures  for  identifying  critical  assets  through  a  mission-focused  process.  They 
added  that  when  considering  the  impact  to  the  mission,  the  concept  of  “mission  (or 
function)  failure”  depends  on  the  organizational  level,  nature,  scope,  conditions,  and 
standards  associated  with  the  mission  and  that  each  mission  is  different.  While  we 
recognize  the  validity  of  this  observation,  we  continue  to  believe  that  the 


Page  15 


GAO-09-740R  Defense  Infrastructure 


identification  of  a  set  of  Tier  1  Task  Critical  Assets  with  similar  levels  of  mission 
criticality  would  be  facilitated  by  the  use  of  consistent  definitions.  Based  on  our 
interviews  with  military  service  officials,  these  different  determinations  of  mission 
failure  make  it  difficult  for  the  services  to  determine  which  assets  are  critical  for 
combatant  command  missions.  Further,  while  DOD  stated  in  its  written  comments 
that  guidance  already  exists  on  mission  essential  tasks,  such  as  the  Joint  Mission 
Essential  Task  List  Development  Handbook,  this  guidance  is  not  referenced  in  DCIP 
directives  and  instructions.  Finally,  DOD  stated  that  ASD(HD&ASA)  will  work  with 
the  Joint  Staff  to  provide  additional  clarification  in  their  critical  asset  guidance,  an 
action  we  believe  is  responsive  to  our  recommendation. 

DOD  partially  concurred  with  our  second  recommendation,  calling  for  the 
development  of  coordination  responsibilities  and  a  coordination  mechanism  within 
DCIP  for  stakeholders  to  use  when  compiling  the  Tier  1  Task  Critical  Asset  list.  DOD 
stated  that  its  current  guidance  establishes  coordination  responsibilities  within  DCIP; 
DOD  Directive  3020.40,  DOD  Instruction  3020.45,  and  DOD  Manual  3020.45  Volume  1 
outline  coordination  responsibilities  among  key  DCIP  stakeholders.  We  acknowledge 
this  DOD  guidance  in  our  report.  However,  based  on  our  discussions  with  military 
service  and  combatant  command  officials,  we  continue  to  believe  that  these 
coordination  responsibilities  need  to  be  specifically  identified.  DOD  stated  that  the 
Joint  Staff  uses  a  formal  Joint  Staff  Action  Process,  which  provides  ample 
opportunity  for  military  service  and  combatant  command  feedback  and  a  means  for 
seeking  clarification  of  guidance.  However,  we  were  told  by  a  Joint  Staff  official  that 
a  formal  Joint  Staff  Action  Process  was  not  issued  for  the  March  2009  Tier  1  Task 
Critical  Asset  list,  and  we  have  not  found  evidence  of  the  issuance  of  one  since 
January  2007.  In  addition,  DOD  also  stated  in  its  written  comments  that  coordination 
mechanisms  exist  within  DCIP,  such  as  the  Operational  Advisory  Board  and  the 
Defense  Critical  Infrastructure  Integration  Staff.  According  to  DOD,  both  of  these 
forums  meet  quarterly  and  are  specifically  designed  to  facilitate  information  sharing. 
However,  military  service  and  combatant  command  officials  told  us  that  the 
coordination  promoted  by  these  existing  mechanisms  does  not  address  asset 
identification,  prioritization,  and  mission  impact  assessment.  Finally,  DOD  stated  it 
will  work  with  the  Joint  Staff  to  determine  what  further  coordination  guidance  is 
needed  and  why  existing  coordination  mechanisms  are  not  being  used  to  identify  and 
prioritize  assets.  We  agree  that  this  is  a  necessary  action  for  DOD  in  order  to  improve 
coordination  within  DCIP  and,  if  pursued,  could  be  responsive  to  our 
recommendation. 

DOD  partially  concurred  with  our  third  recommendation,  calling  for  the  development 
of  a  formal  schedule,  milestones,  and  feedback  process  for  critical  asset 
identification.  According  to  DOD’s  written  comments,  ASD(HD&ASA)  has  developed 
a  draft  DOD  Manual  3020.45  Volume  6  Defense  Critical  Infrastructure  Program 
(DCIP)  Execution  Timeline.  DOD  intends  for  this  manual  to  provide  uniform 
procedures  for  the  execution  of  DCIP  activities  and  timelines  for  DCIP  stakeholders 
to  use  in  coordinating  the  execution  of  DCIP  activities  outlined  in  current  DCIP 
guidance  and  ensure  that  feedback  is  provided  to  the  components.  With  regard  to  the 
DCIP  Critical  Asset  Identification  Process  Collaboration  Tool  that  DOD  intends  to 
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use  as  a  way  to  establish  a  standard  timeline  and  milestones,  we  note  that  this  tool 
could  potentially  improve  the  critical  asset  identification  process  once  it  is 
implemented  if  the  military  services  and  combatant  use  the  tool.  We  continue  to 
believe  that  the  military  services  and  combatant  commands  could  benefit  from  a 
more  formal  data  call  with  deadlines,  milestones,  and  an  opportunity  to  receive 
feedback  from  the  Joint  Staff. 


As  agreed  with  your  offices,  we  are  sending  copies  of  this  report  to  the  Chairmen  and 
Ranking  Member  of  the  Senate  and  House  Appropriations  Subcommittees  on  Defense 
and  on  Military  Construction,  Veterans  Affairs,  and  Related  Agencies;  Senate  and 
House  Committees  on  Armed  Services;  and  other  interested  congressional  parties. 

We  also  are  sending  copies  to  the  Secretary  of  Defense;  the  Chairman,  Joint  Chiefs  of 
Staff;  the  Secretaries  of  the  Army,  the  Navy,  and  the  Air  Force;  the  Commandant  of 
the  Marine  Corps;  and  the  Director,  Office  of  Management  and  Budget.  In  addition, 
the  report  will  be  available  at  no  charge  on  GAO’s  Web  site  at  http://www.gao.gov. 

If  you  or  your  staff  have  any  questions  concerning  this  report,  please  contact  me  at 
(202)  512-5431  or  by  e-mail  at  dagostinod@gao.gov.  Contact  points  for  our  Offices  of 
Congressional  Relations  and  Public  Affairs  may  be  found  on  the  last  page  of  this 
report.  GAO  staff  who  made  key  contributions  to  this  report  are  listed  in  enclosure  II. 


Davi  M.  D’Agostino 
Director 

Defense  Capabilities  and  Management 
Enclosures  -  2 
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List  of  Committees 

The  Honorable  Carl  Levin 
Chairman 

The  Honorable  John  McCain 
Ranking  Member 
Committee  on  Armed  Services 
United  States  Senate 

The  Honorable  Daniel  Inouye 
Chairman 

The  Honorable  Thad  Cochran 
Ranking  Member 
Subcommittee  on  Defense 
Committee  on  Appropriations 
United  States  Senate 

The  Honorable  Tim  Johnson 
Chairman 

The  Honorable  Kay  Bailey  Hutchison 
Ranking  Member 

Subcommittee  on  Military  Construction, 
Veterans  Affairs,  and  Related  Agencies 
Committee  on  Appropriations 
United  States  Senate 

The  Honorable  Ike  Skelton 
Chairman 

The  Honorable  Howard  McKeon 
Ranking  Member 
Committee  on  Armed  Services 
House  of  Representatives 

The  Honorable  John  P.  Murtha 
Chairman 

The  Honorable  C.W.  Bill  Young 
Ranking  Member 
Subcommittee  on  Defense 
Committee  on  Appropriations 
House  of  Representatives 


Page  18 


GAO-09-740R  Defense  Infrastructure 


The  Honorable  Chet  Edwards 
Chair 

The  Honorable  Zach  Wamp 
Ranking  Member 

Subcommittee  on  Military  Construction, 
Veterans  Affairs,  and  Related  Agencies 
Committee  on  Appropriations 
House  of  Representatives 
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Enclosure  I 


Enclosure  I 


Comments  from  the  Department  of  Defense 


ASSISTANT  SECRETARY  OF  DEFENSE 
2600  DEFENSE  PENTAGON 
WASHINGTON,  D.C.  20301-2600 


HOMELAND  DEFENSE 
AMERICAS'  SECURITY  AFFAIRS 

JUL  1  5  2009 

Ms.  Davi  M.  D’Agostino 
Director,  Defense  Capabilities  and  Management 
U.S.  Government  Accountability  Office 
441  G  Street,  N.W. 

Washington,  DC  20548 

Dear  Ms.  D’Agostino: 

This  is  the  Department  of  Defense  (DoD)  response  to  the  GAO  draft  report,  GAO- 
09-740R,  “Defense  Critical  Infrastructure:  Actions  Needed  to  Improve  the  Consistency, 
Reliability,  and  Usefulness  of  DoD’s  Tier  1  Task  Critical  Asset  List,”  dated  June  22, 

2009  (GAO  Code  351341).  DoD  partially  concurs  with  all  three  recommendations.  Our 
response  to  the  recommendations  is  enclosed. 

Our  point  of  contact  for  this  action  is  Mr.  Antwane  Johnson,  Office  of  the 
Assistant  Secretary  of  Defense  for  Homeland  Defense  and  Americas’  Security  Affairs 
(OASD  (HD&ASA)),  (703)  602-5730,  Extension  143  or  Antwane.Johnson@osd.mil. 

Sincerely, 

• 

ChfeLstine  E.  Wormuth 
Principal  Deputy 

Enclosure: 

As  stated 


o 


Page  20 


GAO-09-740R  Defense  Infrastructure 


GAO  DRAFT  REPORT  -  DATED  JUNE  22,  2009 
GAO  CODE  351341  /GAO-09-740R 

"Defense  Critical  Infrastructure:  Actions  Needed  to  Improve  the  Consistency,  Reliability,  and 
Usefulness  of  DoD’s  Tier  1  Task  Critical  Asset  List" 


DEPARTMENT  OF  DEFENSE  COMMENTS 
TO  THE  RECOMMENDATIONS 


RECOMMENDATION  1:  The  GAO  recommends  that  the  Secretary  of  Defense  direct  the 
Assistant  Secretary  of  Defense  for  Homeland  Defense  and  Americas’  Security  Affairs  and  the 
Joint  Staff  to  further  clarify  the  definitions  of  a  Tier  1  Task  Critical  Asset  contained  in  DoD 
Manual  3020.45  Volume  I,  Critical  Asset  Identification  Process,  along  with  definitions  of  key 
elements,  such  as  “mission  essential  tasks.”  Potential  approaches  could  include  establishing  and 
issuing  a  set  of  test  questions  to  apply  to  a  proposed  critical  asset  or  providing  a  set  of 
hypothetical  examples  to  use  in  identifying  critical  assets. 

DOD  RESPONSE:  Partially  concur.  DoD  Manual  3020.45  Volume  I,  Critical  Asset 
Identification  Process,  provides  comprehensive  procedures  for  identifying  critical  assets  through 
the  use  of  a  mission-focused  process.  The  process  begins  with  an  analysis  of  assigned  missions 
and  decomposes  them  to  a  level  that  can  be  directly  tied  to  an  asset.  The  loss  of  the  asset  is  then 
analyzed  to  determine  the  impact  on  the  mission.  If  the  impact  is  mission  failure,  it  is  considered 
a  Tier  1  task  critical  asset.  As  each  mission  is  different,  the  analysis  must  consider  the 
organizational  level,  nature,  scope,  conditions,  and  standards  associated  with  the  mission. 
Mission-essential  tasks  represent  a  commander’s  priority  of  warfighting  requirements  based  on 
assigned  missions.  The  Joint  Mission  Essential  Task  List  (JMETL)  Development  Handbook 
provides  guidance  to  help  commanders  define  their  mission-essential  tasks  along  with  associated 
conditions  and  measurable  standards.  The  DCIP  Office  will  work  with  the  Joint  Staff  to  provide 
additional  clarification  of  this  guidance. 

RECOMMENDATION  2:  The  GAO  recommends  that  the  Secretary  of  Defense  direct  the 
Assistant  Secretary  of  Defense  for  Homeland  Defense  and  Americas’  Security  Affairs  and  the 
Joint  Staff  to  develop  specific  coordination  responsibilities  and  a  coordination  mechanism  within 
the  Defense  Critical  Infrastructure  Program  (DCIP)  for  each  of  those  stakeholders  to  use  when 
compiling  the  list. 

DOD  RESPONSE:  Partially  concur.  Existing  guidance  (DoD  Directive  3020.40,  DoD 
Instruction  3020.45,  and  DoD  Manual  3020.45,  Volume  1)  provides  specific  coordination 
responsibilities  for  each  of  the  components  during  the  critical  asset  identification  process.  In 
addition,  the  Joint  Staff,  when  issuing  a  data  call  for  TCA  submissions,  uses  a  formal  Joint  Staff 
Action  Process  which  provides  ample  opportunity  for  Combatant  Command  and  Service 
feedback  and  a  means  for  seeking  clarification  of  guidance.  OASD  (HD&ASA)  has  established 
forums,  such  as  the  Joint  Staff-chaired  Operational  Advisory  Board  (OAB)  and  the  DCIP  Office- 
chaired  Defense  Critical  Infrastructure  Integration  Staff  (DCIIS).  Both  of  these  forums  meet 
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quarterly  and  are  specifically  designed  to  provide  for  the  identification,  clarification,  and 
resolution  of  CIP  issues  among  stakeholders  and  to  facilitate  information  sharing 

The  DCIP  Office  will  work  with  the  Joint  Staff  to  determine  what,  if  any,  further  guidance  is 
required  regarding  specific  coordination  responsibilities,  and  why  stakeholders  failed  to  employ 
existing  coordination  mechanisms  when  compiling  their  TCA  lists. 

RECOMMENDATION  3:  The  GAO  recommends  that  the  Secretary  of  Defense  direct  the 
Assistant  Secretary  of  Defense  for  Homeland  Defense  and  Americas’  Security  Affairs  and  the 
Joint  Staff  to  formalize  processes  for  compiling  the  Tier  1  Task  Critical  Asset  list,  including  the 
development  of  a  formal  schedule  with  timelines  and  milestones  for  submitting  Tier  1  Task 
Critical  Asset  data  and  a  formal  process  for  the  Joint  Staff  to  provide  feedback  to  the  Combatant 
Commands  and  military  services  regarding  the  assets  they  propose  to  include  on  the  Tier  1  Task 
Critical  Asset  list. 

POD  RESPONSE:  Partially  concur.  OASD  (HD&ASA)  is  formalizing  the  process  for 
compiling  Tier  1  Task  Critical  Task  Asset  list  in  a  draft  manual,  DoDM  3020.45  Volume  6, 
Defense  Critical  Infrastructure  Program  (DCIP)  Execution  Timeline.  The  manual  will  provide 
uniform  procedures  for  the  execution  of  DCIP  activities,  a  standard  timeline,  and  exact 
milestones  that  OASD  (HD&ASA),  the  Joint  Staff,  Military  Departments,  Combatant 
Commands,  Defense  Agencies,  and  the  Defense  Infrastructure  Sector  Lead  Agencies  will  use  to 
coordinate  the  execution  of  activities  and  responsibilities  assigned  in  DoDD  3020.40,  Defense 
Critical  Infrastructure  Program,  DoDI  3020.45,  Defense  Critical  Infrastructure  Program 
Management,  and  DoD  Manual  3020.45,  Defense  Critical  Infrastructure  Program:  DoD  Mission- 
Based  Critical  Asset  Identification  Process,  Volumes  1,  5,  and  7.  The  execution  timeline  will 
ensure  the  development  of  the  Tier  1  TCA  List  and  provide  feedback  to  the  components.  The 
DCIP  Office  is  also  developing  a  collaboration  tool  which,  in  conjunction  the  publication  of 
DoDM  3020.45  ,  will  improve  stakeholder  situational  awareness  of  each  step  in  the  process  of 
identifying  TCAs. 
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